[Qemu-devel] [PATCH] ppc32 guests: fix computation of XER.{CA, OV} in addme, subfme, mullwo

[Julian Seward <jseward@acm.org>]

[-- Attachment #1: Type: text/plain, Size: 535 bytes --]


For ppc32 guests, computation of XER.CA and XER.OV in some obscure
cases is incorrect.  At least, it doesn't produce the same results
as a real MPC7447, and doesn't appear to be in accordance with the
instruction set documentation.

The attached patch fixes it:

* addme{o}{.}, subfme{o}{.}: compute XER.CA correctly

* mullwo{.}: sign extend arguments before doing 64-bit
  multiply, so as to make the XER.OV computation correct

I suspect the handling of the 64-bit equivalents is similarly borked,
but I haven't checked so far.

J

[-- Attachment #2: qemu-ppc32-fix-xer-ca-obscure-cases.diff --]
[-- Type: text/x-diff, Size: 2323 bytes --]

Index: target-ppc/op_helper.c
===================================================================
--- target-ppc/op_helper.c	(revision 4422)
+++ target-ppc/op_helper.c	(working copy)
@@ -147,11 +147,14 @@
 
 void do_addmeo (void)
 {
+    uint32_t argL = T0;
+    uint32_t res  = T0 + xer_ca + (-1);
+    uint32_t carried = res < argL || ((xer_ca & 1) == 1 && res == argL);
     T1 = T0;
-    T0 += xer_ca + (-1);
+    T0 = res;
     xer_ov = ((uint32_t)T1 & ((uint32_t)T1 ^ (uint32_t)T0)) >> 31;
     xer_so |= xer_ov;
-    if (likely(T1 != 0))
+    if (carried)
         xer_ca = 1;
     else
         xer_ca = 0;
@@ -227,9 +230,9 @@
 
 void do_mullwo (void)
 {
-    int64_t res = (int64_t)T0 * (int64_t)T1;
+    int64_t res = ((int64_t)(int32_t)T0) * ((int64_t)(int32_t)T1);
 
-    if (likely((int32_t)res == res)) {
+    if (likely( ((int64_t)(int32_t)res) == ((int64_t)res) )) {
         xer_ov = 0;
     } else {
         xer_ov = 1;
@@ -306,11 +309,14 @@
 
 void do_subfmeo (void)
 {
+    uint32_t argR = -1;
+    uint32_t res  = ~T0 + xer_ca - 1;
+    uint32_t carried = res < argR || ((xer_ca & 1) == 1 && res == argR);
     T1 = T0;
-    T0 = ~T0 + xer_ca - 1;
+    T0 = res;
     xer_ov = ((uint32_t)~T1 & ((uint32_t)~T1 ^ (uint32_t)T0)) >> 31;
     xer_so |= xer_ov;
-    if (likely((uint32_t)T1 != UINT32_MAX))
+    if (carried)
         xer_ca = 1;
     else
         xer_ca = 0;
Index: target-ppc/op.c
===================================================================
--- target-ppc/op.c	(revision 4422)
+++ target-ppc/op.c	(working copy)
@@ -883,8 +883,11 @@
 /* add to minus one extended */
 void OPPROTO op_add_me (void)
 {
-    T0 += xer_ca + (-1);
-    if (likely((uint32_t)T1 != 0))
+    uint32_t argL = T0;
+    uint32_t res  = T0 + xer_ca + (-1);
+    uint32_t carried = res < argL || ((xer_ca & 1) == 1 && res == argL);
+    T0 = res;
+    if (carried)
         xer_ca = 1;
     else
         xer_ca = 0;
@@ -1176,8 +1179,11 @@
 /* subtract from minus one extended */
 void OPPROTO op_subfme (void)
 {
-    T0 = ~T0 + xer_ca - 1;
-    if (likely((uint32_t)T0 != UINT32_MAX))
+    uint32_t argR = -1;
+    uint32_t res  = ~T0 + xer_ca - 1;
+    uint32_t carried = res < argR || ((xer_ca & 1) == 1 && res == argR);
+    T0 = res;
+    if (carried)
         xer_ca = 1;
     else
         xer_ca = 0;